Freeze actual provider offer revision and configuration before SDK preparation

guarantees/agent/golden/scenes/component-boundaries.scene.yaml

@@ -60,6 +60,18 @@ workflow:
   - id: campaign-fresh-estimates-native
     action: { verifier: agent.golden.campaign-fresh-estimates-native }
     expect: { status: passed }
+  - id: campaign-offers-read-unit
+    action: { verifier: agent.golden.campaign-offers-read-unit }
+    expect: { status: passed }
+  - id: campaign-offers-denials-unit
+    action: { verifier: agent.golden.campaign-offers-denials-unit }
+    expect: { status: passed }
+  - id: campaign-offers-binding-unit
+    action: { verifier: agent.golden.campaign-offers-binding-unit }
+    expect: { status: passed }
+  - id: campaign-offers-native
+    action: { verifier: agent.golden.campaign-offers-native }
+    expect: { status: passed }
   - id: campaign-policy-native
     action: { verifier: agent.golden.campaign-policy-native }
     expect: { status: passed }

guarantees/agent/golden/sdk-complete.guarantee.yaml

@@ -11,6 +11,8 @@ scene:
   required: true
   manifest: guarantees/agent/golden/scenes/sdk-complete.scene.yaml
 acceptanceCriteria:
+  - criterion: 2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7
+    verifierRefs: [agent.golden.live.campaign-freeze, agent.golden.live.campaign]
   - criterion: 64ffc06b0d268ad11fbf692ca201cd75423c0afae2a6be3e2ae7cd2eea7fb17f
     verifierRefs: [agent.golden.live.campaign, api.golden.execution-normal-sdk-clean-schema-live-1, agent.golden.architecture-record-custody-live-1, agent.golden.architecture-living-graph-live-1]
   - criterion: 6c6e922d724fe9bf966e3f11456af2f176224cdff4792c9b7a73ce8047659e55

guarantees/verifiers/golden.verifiers.yaml

@@ -421,6 +421,26 @@ verifiers:
     ownerPackage: "@treeseed/agent"
     testFile: tests/modern/guarantees/preflight/campaign-freeze.test.ts
     testName: "uses the original operator proposal and start and denies changed CLI intent or policy before any proposal creation"
+  agent.golden.campaign-offers-read-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts
+    testName: "reads every exact frozen provider offer revision and original configuration through the public boundary without changing supplied observations"
+  agent.golden.campaign-offers-denials-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts
+    testName: "denies missing malformed foreign moved duplicated and incomplete provider offer authority while retaining every original failed input before exact retry"
+  agent.golden.campaign-offers-binding-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts
+    testName: "selects original provider offer readback in the normal SDK freeze and retains preparation evidence before proposal creation"
+  agent.golden.campaign-offers-native:
+    kind: vitestCase
+    ownerPackage: "@treeseed/agent"
+    testFile: tests/modern/guarantees/preflight/campaign-offers-native.test.ts
+    testName: "native owning provider offers and public SDK reads retain exact frozen revision configuration denial and interruption observations before unchanged concurrent retry"
   agent.golden.campaign-policy-native:
     kind: vitestCase
     ownerPackage: "@treeseed/agent"

tests/acceptance/freeze-integrity.test.ts

@@ -4,6 +4,7 @@ import test from 'node:test';
 import { readCampaignProjectLibraries, readCampaignRepositoryBases, readPreRunCampaignFreeze, verifyCampaignWorkdayPolicy, verifyFreezeIntegrity } from './freeze-integrity.ts';
 import { read } from './acceptance-cli.ts';
 import { readCampaignProfiles } from './workday/support/preflight/campaign-profiles.ts';
+import { readCampaignProviderOffers } from './workday/support/preflight/campaign-provider-offers.ts';
 
 test('Golden pre-run campaign freeze retains every schema-valid expanded input and original manifest bytes before SDK execution', () => {
 	const original = readPreRunCampaignFreeze();
@@ -14,10 +15,14 @@ test('Golden pre-run campaign freeze retains every schema-valid expanded input a
 	const protectedHeads = readCampaignRepositoryBases(original);
 	const profiles = readCampaignProfiles(original, bindings, team);
 	const policy = verifyCampaignWorkdayPolicy(original.manifest, read(['workdays', 'profiles', 'show', 'default'], team), bindings.get('sdk')?.teamId);
+	const providerOffers = readCampaignProviderOffers(original.manifest, team);
 	assert.deepEqual(readCampaignProjectLibraries(original.manifest, team), bindings);
 	assert.deepEqual(readCampaignRepositoryBases(original), protectedHeads);
 	assert.deepEqual(readCampaignProfiles(original, bindings, team), profiles);
 	assert.deepEqual(verifyCampaignWorkdayPolicy(original.manifest, read(['workdays', 'profiles', 'show', 'default'], team), bindings.get('sdk')?.teamId), policy);
+	const finalProviderOffers = readCampaignProviderOffers(original.manifest, team);
+	assert.deepEqual([...finalProviderOffers.keys()], [...providerOffers.keys()]);
+	console.log(JSON.stringify({ providerOfferReadback: { before: [...providerOffers], after: [...finalProviderOffers] } }));
 	const independentlyRead = readPreRunCampaignFreeze();
 	assert.deepEqual(independentlyRead, original);
 	assert.deepEqual(readFileSync(original.path), held);

tests/acceptance/prepare-campaign.ts

@@ -8,6 +8,7 @@ import { read } from './acceptance-cli.ts';
 import { readCampaignProfiles } from './workday/support/preflight/campaign-profiles.ts';
 import { freshSdkDraft, requirePlanningWindow, sdkProposalText, sdkCampaignWindow } from './campaign.ts';
 import { readCampaignProjectLibraries, readCampaignRepositoryBases, readPreRunCampaignFreeze, verifyCampaignWorkdayPolicy, verifyRuntimeClosure } from './freeze-integrity.ts';
+import { readCampaignProviderOffers } from './workday/support/preflight/campaign-provider-offers.ts';
 
 type Row = Record<string, any>;
 export function requirePinnedCodex(pinned: string, installed: string): void {
@@ -122,6 +123,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team:
 		read(['workdays', 'profiles', 'show', 'default'], team), libraries.get('sdk')?.teamId);
 	const protectedHeads = readCampaignRepositoryBases(operatorFreeze);
 	const profiles = readCampaignProfiles(operatorFreeze, libraries, team);
+	const providerOffers = readCampaignProviderOffers(operatorFreeze.manifest, team);
 	const agentPath = resolve(platform, 'packages/agent');
 	const pinnedCodex = (JSON.parse(readFileSync(join(agentPath, 'package.json'), 'utf8')) as Row).dependencies['@openai/codex'] as string;
 	const installedCodex = execFileSync(join(agentPath, 'node_modules/.bin/codex'), ['--version'], { encoding: 'utf8', timeout: 30_000 }).trim();
@@ -156,6 +158,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team:
 	verifySdkPublishedProfiles(sdkProfiles.inventory.agents as Row[], sdkProfiles.ref);
 	const providers = (read(['providers', 'list'], team).items as Row[]).filter(item => item.status === 'approved');
 	assert.equal(providers.length, 1, 'ACCEPTANCE_CAMPAIGN_SUPPLY: Individual host campaign requires unambiguous provider');
+	assert.ok(providerOffers.has(providers[0]!.providerId), 'ACCEPTANCE_CAMPAIGN_OFFERS: Selected provider differs from frozen offer authority');
 	const supply = read(['providers', 'status', providers[0]!.providerId], team);
 	requireSdkCampaignSupply(supply, durationSeconds, planningPercent, new Date().toISOString());
 	const project = draft.projectId as string;
@@ -190,6 +193,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team:
 	capture('protected-staging-heads.json', JSON.stringify(protectedHeads));
 	capture('architecture-book.json', JSON.stringify(bookReadback));
 	capture('governed-agent-profiles.json', JSON.stringify([...profiles]));
+	capture('provider-offers.json', JSON.stringify([...providerOffers]));
 	capture('codex-version.json', JSON.stringify({ pinned: pinnedCodex, installed: installedCodex }));
 	const runtime = read(['dev', 'status'], team, true);
 	capture('runtime.json', JSON.stringify(runtime)); capture('supply.json', JSON.stringify(supply));
@@ -203,6 +207,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team:
 		'ACCEPTANCE_CAMPAIGN_FREEZE: Protected repositories changed during preparation');
 	assert.deepEqual(readCampaignProfiles(operatorFreeze, libraries, team), profiles,
 		'ACCEPTANCE_CAMPAIGN_PROFILES: Governed profiles changed during preparation');
+	capture('provider-offers-final.json', JSON.stringify([...readCampaignProviderOffers(operatorFreeze.manifest, team)]));
 	const current = read(['proposals', 'show', id, '--server', 'local', '--project', project], team, true);
 	writeFileSync(freezePath, JSON.stringify({ createdAt: new Date().toISOString(),
 		proposal: { id, revision: current.activeVersion, digest: current.activeContentHash, estimates: 0 }, request, preflight, sourceHeads,

tests/acceptance/workday/support/preflight/campaign-provider-offers.ts

@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+import { capabilityOfferDigest, capabilityOfferSchema } from '@treeseed/sdk/capacity-provider';
+import { read, row, type Row } from '../../../acceptance-cli.ts';
+
+function frozenSupply(manifest: Row): Row[] {
+	assert.ok(Number.isSafeInteger(manifest.providerOfferRevision) && Number(manifest.providerOfferRevision) > 0, 'ACCEPTANCE_CAMPAIGN_OFFERS: Exact frozen offer revision required');
+	const supply = row(row(manifest.allocationInputsByRun).sdk).providerSupply;
+	assert.ok(Array.isArray(supply) && supply.length > 0, 'ACCEPTANCE_CAMPAIGN_OFFERS: Complete frozen provider supply required');
+	const values = supply.map(row), ids = values.map(value => value.providerId);
+	assert.ok(ids.every(id => typeof id === 'string' && id && id.trim() === id) && new Set(ids).size === ids.length,
+		'ACCEPTANCE_CAMPAIGN_OFFERS: Exact unique frozen providers required');
+	return values;
+}
+
+function authority(offers: unknown): Row[] {
+	const code = 'ACCEPTANCE_CAMPAIGN_OFFERS';
+	assert.ok(Array.isArray(offers) && offers.length > 0, `${code}: Original complete offer inventory required`);
+	const ids = new Set<string>();
+	return offers.map(value => {
+		const original = row(value);
+		assert.deepEqual(Object.keys(original).sort(), ['executionProviderId', 'offerId', 'offerDigest', 'offer', 'status', 'observedAt'].sort(),
+			`${code}: Original native offer fields required`);
+		assert.ok(typeof original.executionProviderId === 'string' && original.executionProviderId && original.executionProviderId.trim() === original.executionProviderId
+			&& typeof original.status === 'string' && original.status && original.status.trim() === original.status, `${code}: Exact native owner and status required`);
+		assert.ok(typeof original.observedAt === 'string' && Number.isFinite(Date.parse(original.observedAt)), `${code}: Original observation clock required`);
+		const offer = capabilityOfferSchema.parse(original.offer);
+		assert.deepEqual(offer, original.offer, `${code}: Native offer must already be canonical`);
+		const { offerDigest, ...material } = offer;
+		assert.equal(offerDigest, capabilityOfferDigest(material), `${code}: Original offer digest differs from its configuration`);
+		assert.equal(original.offerId, offer.offerId); assert.equal(original.offerDigest, offerDigest);
+		assert.ok(!ids.has(offer.offerId), `${code}: Duplicate native offer identity`); ids.add(offer.offerId);
+		// Heartbeat time is observation metadata. All original offer authority,
+		// including inactive unrelated offers, remains visible and compared.
+		const { observedAt: _clock, ...configuration } = original;
+		return configuration;
+	});
+}
+
+/** The existing public inventory and frozen original offer rows are authority;
+ * the inventory's revision alone cannot establish unchanged configuration. */
+export function verifyCampaignProviderOffer(manifest: Row, providerId: string, observed: unknown): Row {
+	const code = 'ACCEPTANCE_CAMPAIGN_OFFERS', supplied = frozenSupply(manifest).filter(value => value.providerId === providerId);
+	assert.equal(supplied.length, 1, `${code}: Exact frozen provider required`);
+	const inventory = row(observed);
+	assert.deepEqual(Object.keys(inventory).sort(), ['schemaVersion', 'providerId', 'revision', 'offers'].sort(), `${code}: Original public inventory required`);
+	assert.equal(inventory.schemaVersion, 'treeseed.provider-offer-inventory/v1', code);
+	assert.equal(inventory.providerId, providerId, `${code}: Foreign provider inventory`);
+	assert.equal(inventory.revision, manifest.providerOfferRevision, `${code}: Public offer revision differs from frozen authority`);
+	assert.deepEqual(authority(inventory.offers), authority(supplied[0]!.offers), `${code}: Public offer configuration differs from frozen authority`);
+	return inventory;
+}
+
+export function readCampaignProviderOffers(manifest: Row, team: string, reader: typeof read = read): Map<string, Row> {
+	assert.ok(typeof team === 'string' && team && team.trim() === team, 'ACCEPTANCE_CAMPAIGN_OFFERS: Explicit owning team required');
+	const supply = frozenSupply(manifest);
+	// Validate every frozen row before the first public read; never substitute
+	// a registry version, another provider, or a partially checked inventory.
+	for (const value of supply) authority(value.offers);
+	return new Map(supply.map(value => {
+		const providerId = String(value.providerId);
+		return [providerId, verifyCampaignProviderOffer(manifest, providerId, reader(['providers', 'offers', 'show', providerId], team))];
+	}));
+}

tests/modern/guarantees/bindings.test.ts

@@ -179,6 +179,7 @@ describe('capacity-provider guarantee execution bindings', () => {
 			'b918b519ac545fdd61faab208687ccc64e1f3d03c9a84dfc57a5cfee6190f3f3',
 		].map(criterion => ({ criterion, verifierRefs: ['agent.golden.live.campaign-freeze'] }));
 		expect(manifest.acceptanceCriteria).toEqual([
+			{ criterion: '2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7', verifierRefs: ['agent.golden.live.campaign-freeze', 'agent.golden.live.campaign'] },
 			{ criterion: '64ffc06b0d268ad11fbf692ca201cd75423c0afae2a6be3e2ae7cd2eea7fb17f', verifierRefs: ['agent.golden.live.campaign', 'api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1', 'agent.golden.architecture-living-graph-live-1'] },
 			{ criterion: '6c6e922d724fe9bf966e3f11456af2f176224cdff4792c9b7a73ce8047659e55', verifierRefs: ['api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1'] },
 			{ criterion: '2e5d3dfc2cd33fd0656866a59ce59153137c199b766309decab4f71ecbf4e8d7', verifierRefs: ['api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1'] },

tests/modern/guarantees/preflight/campaign-freeze.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, afterEach, expect, it, vi } from 'vitest';
 import { createHash } from 'node:crypto';
 import { resolve } from 'node:path';
 import { stringify } from 'yaml';
+import { campaignOffers } from './campaign-offers-fixture.ts';
 
 const state = vi.hoisted(() => ({ bytes: '{}', reads: [] as string[], files: new Map<string, string>(),
 	commands: vi.fn(), writes: vi.fn(), execute: vi.fn(), publicRead: vi.fn() }));
@@ -265,6 +266,8 @@ it('uses the original operator proposal and start and denies changed CLI intent
 	const canonical = sdkProposalText(document), head = 'a'.repeat(40);
 	const supplied = campaignInputs(portfolioRelations(document, seed).projects.map(project => project.slug), seed);
 	const sdk = supplied.allocationInputsByRun.sdk!;
+	const frozenOffers = campaignOffers().inventory.offers;
+	for (const provider of sdk.providerSupply) Reflect.set(provider, 'offers', structuredClone(frozenOffers));
 	const bookFrontmatter = { id: canonical.architectureBook.id, title: canonical.architectureBook.title,
 		schemaVersion: 'treeseed.book/v3', projectId: sdk.input.projects[0], revision: 1, status: 'published' };
 	const content = `---\n${stringify(bookFrontmatter)}---\n\nControlled published Book\n`;
@@ -278,7 +281,7 @@ it('uses the original operator proposal and start and denies changed CLI intent
 	state.files.set('/supplied-platform/seeds/treeseed.yaml', seed); state.files.set('/draft.json', JSON.stringify(template));
 	state.writes.mockImplementation((path: string, bytes: string) => state.files.set(path, bytes));
 	for (const scenario of ['intent-drift', 'policy-drift', 'policy-team', 'policy-owner-missing', 'policy-malformed', 'policy-unknown',
-		'project-drift', 'lookup-team-drift', 'lookup-slug-drift', 'lookup-repository-missing', 'lookup-denied', 'unchanged']) {
+		'offer-revision', 'offer-provider', 'offer-denied', 'project-drift', 'lookup-team-drift', 'lookup-slug-drift', 'lookup-repository-missing', 'lookup-denied', 'unchanged']) {
 		state.bytes = JSON.stringify(supplied); state.writes.mockClear(); state.commands.mockClear(); state.execute.mockClear(); state.publicRead.mockClear();
 		state.execute.mockImplementation((command: string, args: string[]) => command.endsWith('/codex') ? 'codex-cli 0.158.0'
 			: args.includes('--refs') ? `${head}\trefs/heads/staging\n`
@@ -305,7 +308,12 @@ it('uses the original operator proposal and start and denies changed CLI intent
 			if (args[0] === 'library') return { result: { repoId: 'repo_supplied', resolvedRef: head,
 				files: [{ path: canonical.architectureBook.path, content, frontmatter: bookFrontmatter }] } };
 			if (args[0] === 'agents') return campaignProfiles(args[3]!, head, `repository-${args[3]}`).inventory;
-			if (args[0] === 'providers' && args[1] === 'list') return { items: [{ status: 'approved', providerId: 'supplied' }] };
+			if (args[0] === 'providers' && args[1] === 'offers') {
+				if (scenario === 'offer-denied') throw new Error('ACCEPTANCE_CLI_COMMAND: providers.offers.show denied');
+				return { schemaVersion: 'treeseed.provider-offer-inventory/v1', providerId: scenario === 'offer-provider' ? 'foreign' : args[3],
+					revision: scenario === 'offer-revision' ? supplied.providerOfferRevision + 1 : supplied.providerOfferRevision, offers: structuredClone(frozenOffers) };
+			}
+			if (args[0] === 'providers' && args[1] === 'list') return { items: [{ status: 'approved', providerId: 'supplied-provider' }] };
 			if (args[0] === 'providers') {
 				const now = new Date().toISOString(), measured = { day: now.slice(0, 10), observedAt: now, healthy: true, activeSeconds: 0, reservedSeconds: 0 };
 				return { healthy: true, availability: [{ refreshed_at: now, executionProviders: [{ id: 'supplied', status: 'active',
@@ -328,7 +336,7 @@ it('uses the original operator proposal and start and denies changed CLI intent
 			if (scenario === 'intent-drift' || scenario.startsWith('policy-'))
 				expect(() => prepareSdkCampaign('/draft.json', '/sdk.freeze.json', 'supplied-team')).toThrow('ACCEPTANCE_CAMPAIGN_FREEZE');
 			else expect.soft(() => prepareSdkCampaign('/draft.json', '/sdk.freeze.json', 'supplied-team'))
-				.toThrow(/ACCEPTANCE_(CAMPAIGN_FREEZE|PROJECT_LIBRARY|CLI_COMMAND)/u);
+				.toThrow(/ACCEPTANCE_(CAMPAIGN_FREEZE|CAMPAIGN_OFFERS|PROJECT_LIBRARY|CLI_COMMAND)/u);
 			expect(state.writes).not.toHaveBeenCalled();
 			expect(state.publicRead.mock.calls.filter(call => call[0][0] === 'proposals')).toHaveLength(0);
 			if (scenario === 'project-drift' || scenario.startsWith('lookup-')) expect.soft(state.execute).not.toHaveBeenCalled();